> anyone has ever tested a way to detect VPN Traffic? If it's using IPSEC, then it should be easy to detect due to use of well-known ports. That said, Bro doesn't have any IPSEC analyzers (if you're interested in contributing some, please let us know!). Vern